CVE-2024-20392
Severity CVSS v4.0:
Pending analysis
Type:
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Publication date:
15/05/2024
Last modified:
06/08/2025
Description
A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. <br />
<br />
This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:cisco:asyncos:11.0.3-238:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:11.1.0-069:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:11.1.0-128:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.0.0-419:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.1.0-071:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.1.0-087:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.1.0-089:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.5.0-066:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.5.3-041:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:12.5.4-041:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:13.0.0-392:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:13.0.5-007:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:13.5.1-277:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:13.5.4-038:*:*:*:*:*:*:* | ||
| cpe:2.3:o:cisco:asyncos:14.0.0-698:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page